diff --git a/.jules/sentinel.md b/.jules/sentinel.md
index 1959a5253..633bdfca9 100644
--- a/.jules/sentinel.md
+++ b/.jules/sentinel.md
@@ -4,3 +4,7 @@
 **Vulnerability:** Found an unused `_attempt_import` function in `src/codeweaver/server/mcp/server.py` that dynamically imports a module directly from unvalidated configuration (`import_module(mw.rsplit(".", 1)[0])`), leading to potential arbitrary code execution.
 **Learning:** Functions that perform dynamic imports should not be left around in the codebase if they are unused, especially if they are designed to take unvalidated strings as input.
 **Prevention:** Avoid dynamic imports based on configuration or inputs without strict whitelisting. Use tools like `semgrep` with python security rules to actively catch these patterns.
+## 2026-06-04 - Arbitrary Code Execution in AST eval
+**Vulnerability:** Found that when validating AST trees for dynamic type evaluation using `eval()`, allowing generic `ast.Call` nodes introduced an Arbitrary Code Execution (ACE) vulnerability, permitting the execution of any callable in the module's global namespace.
+**Learning:** `ast.Call` nodes in type annotations (e.g., inside `Annotated[]`) must be strictly validated. Merely allowing `ast.Call` as a node type is insufficient if `eval()` is subsequently called, as it can execute unintended functions.
+**Prevention:** Strictly whitelist allowed functions in `ast.Call` nodes (e.g., `Depends`, `depends`, `Field`, `PrivateAttr`, `Tag`, `Parameter`) by checking the node's function name before permitting the node in the AST validation step.
diff --git a/src/codeweaver/core/di/container.py b/src/codeweaver/core/di/container.py
index 7cd68ce98..328444a0f 100644
--- a/src/codeweaver/core/di/container.py
+++ b/src/codeweaver/core/di/container.py
@@ -84,7 +84,7 @@ def __init__(self) -> None:
         self._request_cache: dict[Any, Any] = {}  # Keys can be types or callables
         self._providers_loaded: bool = False  # Track if auto-discovery has run
 
-    def _safe_eval_type(self, type_str: str, globalns: dict[str, Any]) -> Any | None:
+    def _safe_eval_type(self, type_str: str, globalns: dict[str, Any]) -> Any | None:  # noqa: C901
         """Safely evaluate a type string using AST validation.
 
         Parses the type string into an AST, validates that it contains only safe
@@ -136,6 +136,19 @@ def generic_visit(self, node: ast.AST) -> None:
                 if isinstance(node, ast.Attribute) and node.attr.startswith("__"):
                     raise TypeError(f"Forbidden dunder attribute: {node.attr}")
 
+                # Security concern: ast.Call permits arbitrary code execution during eval.
+                # Must strictly whitelist allowed functions used in type annotations.
+                if isinstance(node, ast.Call):
+                    allowed_funcs = {"Depends", "depends", "Field", "PrivateAttr", "Tag", "Parameter"}
+                    func_name = None
+                    if isinstance(node.func, ast.Name):
+                        func_name = node.func.id
+                    elif isinstance(node.func, ast.Attribute):
+                        func_name = node.func.attr
+
+                    if func_name not in allowed_funcs:
+                        raise TypeError(f"Forbidden function call in type string: {func_name}")
+
                 super().generic_visit(node)
 
         try: